Rule Definition
Component-heavy development patterns can lead to development teams not even understanding which components they use in their application or API, much less keeping them up to date.
Remediation
Use the Cookie framework instead (https://github.com/js-cookie/js-cookie)
Violation Code Sample
// set value
$.cookie('name', 'value');
// get value
$.cookie('name'); // => "value"
Fixed Code Sample
// set value
Cookies.set('name', 'value', { domain: 'subdomain.site.com' });
// get value
Cookies.get('name'); // => 'value'
Reference
https://www.owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities
Related Technologies
Technical Criterion
PCI-DSS4-Requirement-6.3.2 - An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management.
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.